Seems to be exploited and confirmed by Defused

https://vulnerability.circl.lu/comment/fdd15828-339e-4711-a71a-6b92792a4aaf